EU Health Data Space and EU Data Act and Clinical Trials Regulation

Publication date: February 21, 2024

In this presentation prepared for the American Bar Association Joint Committee Meeting of TIPS (Tort, Trial and Insurance Practice) Medicine & Law International Section International Life Sciences and Health, and Intellectual Property Section Law Practice Management we are going to focus on three aspects. First – case study of medical device litigation; secondly – we are going to discuss the legislative landscape of data legislation in European Union and as third part, we are going to discuss the most crucial assumptions implemented by the of Regulation (EU) No 536/2014 of the European Parliament and of the Council of 16th April 2014 on clinical trials on medicinal products for human use, with a particular emphasis on the Clinical Trials Information System (CTIS).

case study

So, let us firstly discuss the case study, namely the legal situation of our client – a manufacturer of a medical device on a global scale, which, as an investor, first creates new high-risk medical devices in Germany and then sells its implants for aesthetic procedures in the internal channel to private clinics all over the world through its responsible entities. The basis of the civil case is trivial, because the patient sues the manufacturer of the medical device for compensation and reimbursement of treatment costs. The banality results from the fact that in Europe there are many court cases brought by patients who claim compensation for allegedly defective surgery.

The legal assessment of product liability in this case differs from the standards, and all the differences in this case in the background of standard cases have a common denominator: namely, it is a medical device for aesthetic surgery. This is the source of the difference.

I believe that the best introduction is to show why this case is particularly difficult to represent in court; how this case differs from standard cases in courts in Europe and why this case creates a special case for our firm’s lawyers specializing in litigation and regulatory matters in the health sector, but it is a special case for our client’s market situation.

The facts of the case are seemingly trivial, as in this case only one patient wants compensation and reimbursement from the manufacturer. The patient sues the manufacturer of the device in one lawsuit for payment of damages. The patient claims that the product, instead of aesthetically affecting the well-being of a healthy person, has caused a very severe form of cancer. The patient sees the cause of her disease in a medical device, a type of silicone that reacted with body tissue.

How this case differs from standard court cases in Europe:

1/ firstly, the lack of key evidence – and this is, paradoxically, a situation consistent with medical law.

It is standard that in the majority of cases, the court files contain the basic evidence – a secured specific medical device. As a standard, the device should be secured by the hospital and the doctor who operated on the patient;

These specific implants from our case study are not involved in this case because the procedure of inserting and removing the implant was allegedly correct and in such situation there is no need to protect the implants.

Therefore, this case makes us think whether it makes sense to conduct a trial where there is no basic evidence; all other evidence is subsidiary.

The plaintiff in the lawsuit applies for a number of evidence from special forensic experts who, based on the patient’s current condition, are to assess whether a medical device that is not in the files is the source of cancer.

It is standard that the first expert evidence is evidence of a technical examination of a medical device. This is a specialized examination to determine whether the product has cracked because the material is defective.

2/ secondly, the health condition of the plaintiff in our case is not related to a specific surgical procedure;

the standard is that the damage is associated with a specific event in the hospital, with a specific medical procedure that went well or was defective;

In this case, the patient claims that the silicone from implant reacted with the patient’s body and caused cancer, and the process of developing the disease lasted 10 years.

In this case, the implant was placed 10 years ago and the operation went well in a private clinic;

In this case, years later, during normal health check-ups, the patient was diagnosed with breast cancer; therefore, the removal of the implants occurred as part of the removal of cancer tissue;

The cancer procedure was successful and the cancer tissue was removed. Therefore, the implants were not secured by the doctor.

Why this case creates a special challenge for lawyers:

1/ firstly, plastic surgery is a private sector in Europe, and medical devices are not purchased under public procurement procedures refinanced by the state;

It is standard that in Europe, procedures are performed by public clinics and state hospitals. The hospital has specific and restrictive procedures for purchasing medical devices for surgery procedures. It is standard that the hospital’s public order checks all documentation of the introduction of the medical device and checks whether the medical device is dedicated to a specific procedure and whether the medical device is compatible with other devices used for the procedure and whether the doctor knows how to use the medical device.

Therefore, there are no documents in the case as to how a private doctor came into possession of a medical device.

2/ secondly, plastic medicine surgical procedures are not intended to treat a specific disease unit.

It is standard that the hospital aims to cure the disease. The medical procedure and the medical device used are intended to cure the disease.

In this case, the medical device has an aesthetic purpose in a healthy person. The improvement in well-being means that aesthetic treatments are not subject to all the restrictions of normal and standard surgery.

3/ thirdly, under European Union law, the user of a medical device such as an implant is not only the doctor who uses the implant during plastic surgery. The end user in this case is also the patient. The patient must follow hygiene and movement rules and regular check-ups so that the implant does not break.

It is standard that the patient is instructed on the need for regular examination of the implant and periodic checking of the condition of the implant. In our situation, the patient did not perform such regular tests and there is no such data of medical screening.

The standard is that the doctor is the end user of the medical device to perform the procedure.

In this case, there are basically two users of this medical device. First there is the doctor and there is the patient.

This is very important in this matter, because there is scientific evidence that most mechanical micro-damages to medical devices are caused by the introduction of the implant into the body. Whether this is the case shows that it is very difficult to objectively assess whether the breakage of the device is the result of a defect in the device, the patient’s poor lifestyle or a faulty insertion procedure.

Why this case creates a special case for lawyers and our client’s protection:

1/ firstly, the case is important because it may be a gateway to further lawsuits, because there is a large group of women who claim that their implants are also defective;

It is interesting that the plaintiff in court is also a very well-known person on social media and uses various methods to encourage other women to file such lawsuits.

It is standard in the medical market that if a medical device is defective, a doctor is obliged to report a medical incident.

2/ secondly, in cases of compensation for defects in a medical device, there is no comprehensive solution in the form of a class action lawsuit.

It is standard that the phenomenon of a large number of potential claims on the market is discharged systemically through the mechanism of a class action, where many plaintiffs in one lawsuit seek payment from the manufacturer.

In matters of medical procedure, each case is heard by a civil court of all instances.

Therefore, the client’s market situation gives the potential for many such cases in the future, and this affects the value of the dispute;

3/ thirdly, in the plastic surgery industry, medical device manufacturers do not want to directly conflict with doctors who purchase medical devices for their surgeries. It is the doctor who suggests a particular type of implant, not the patient.

It is standard that in medical cases, the second defendant, in addition to the manufacturer of the medical device or its responsible entity, is always the hospital or a doctor.

When preparing the process strategy, we took into account the following issues:

– can we certainly rule out that the implant was not damaged when it was placed in the patient’s body, because when reading scientific publications it can be concluded that a significant percentage of damage, even micro-damage, occurs at the moment of implantation, that is when the implant is implanted into the patient’s body;

– whether the patient complied with post-implantation guidelines and instructions, that is regular examinations, appropriate lifestyle after implant insertion, monitoring the condition of the implant in the body;

– which court is competent to hear the case, because the rule is that the plaintiff goes to the defendant’s court, but since the defendant is based abroad, an exception is sought and in this litigation the lawsuit indicates the place of damage, i.e. the plaintiff’s place of residence; however, we argue that this is an incorrect definition of the place where the damage occurred. This case is fundamentally different from typical medical malpractice or medical device cases. Usually, a defect in a medical device is revealed during an operation or procedure. Therefore, it is standard that the case is heard in the court where the hospital or clinic is located. The method of implanting the patient is always important. In this case, 10 years passed between the surgery to insert implants in a private clinic in one city and the surgery to remove the implants for cancer treatment in another city. Therefore, this creates doubts as to which court will hear the case.

– our strategy is also to determine whether the patient is not a carrier of the Brca 1 and Brca 2 gene mutations, because such mutations occurred in the patient’s immediate family;

– the case also shows flexibility as to the burden of proof. In the Polish procedure, the party to the dispute must provide evidence of the facts from which it draws its legal consequences. In our case, this will be evidence of the lack of defects of the medical device and evidence of proper introduction of such a medical device to the market.

Second part of our presentation will be short summary of the legislative landscape of the European Union in respect of data an in particular, medical and health data.

In recent years the European Commission developed a European data strategy, which aims to create a single European market in which data can circulate freely.

Currently this is the area where a number of regulations are implemented.

On the 6th of December 2023 European Union member state ambassadors have agreed on the Council’s mandate for a new law that will make it easier to exchange and access health data at European Union level. The proposed regulation for a European Health Data Space (EHDS) aims to improve individuals’ access to and control over their personal electronic health data, while also enabling certain data to be reused for research and innovation purposes. It provides for a health-specific data environment that will help foster a single market for digital health services and products.

Currently, European researchers, policy-makers and businesses face many obstacles to accessing health data nationally and across borders. At present, data cannot be fully used, to the detriment of health policy and innovation such as the development of more effective medicines and treatments.

The main obstacle is different interpretations of the General Data Protection Regulation (GDPR). In addition, practices for collecting and processing health data vary from one EU country to another because of differences in their national legislation.

Primary use of electronic health data – Under the proposal, natural persons should have the right to access their personal electronic health data processed in the context of primary use of electronic health data, immediately, free of charge and in an easily readable, consolidated and accessible form. They should easily share such data with other health professionals within and between Member States in order to improve the delivery of health care.

The project provides for broad-based obligations regarding the provision of data for secondary use. The Project indicates that data holders will be obliged to make available for secondary use, among others:

– data that impacts health, including social, environmental and behavioral determinants of health;

– health-related administrative data, including claims and cost data;

– human genetic, genomic and proteomic data;

– electronic health data, including those generated by medical devices, wellness applications, or other digital health applications;

The new EU health data space will help in unifying the rules of health data handling. The expected final legal text is in 2024.

Our law firm advises clients in cases involving medicinal products, medical devices, market authorization and clinical trials and in all types of such assistance we need to consider EU rules on data handling, data transfers and data processing.

The Council’s mandate provides clarity on issues such as the scope of the regulation, alignment with the General Data Protection Regulation (GDPR) and the criteria for providing access to electronic health data.

These rules need to be analysed for example by providers of online platforms, manufacturers of wearables using software that processes patients’ data.

Let us now focus on the second EU legislation and that is the EU Data Act.

The EU regulation on harmonized rules on fair access to and use of data, i.e., the Data Act entered into force on 11 January 2024 –

It has implications for medical devices and other health devices

The Data Act lays down harmonised rules on data generated by the use of connected products or product-related services available by data holders to the user of the connected product or service, to third parties authorised by the user, and to public-sector bodies.

Since the Data Act covers any connected physical product that obtains, generates or collects data concerning its use or environment (i.e. IoT products), this includes medical devices and other health devices, such as pacemakers, continuous glucose monitors and smart insulin pens, wellness wearables and fitness trackers, ingestible sensors, Magnetic resonance imaging and X-ray scanners.

The data-sharing obligations and rights under the Data Act apply to data generated through the use of a connected medical device or other connected health devices (i.e. data that the user intentionally records, such as inputting meals into a diet app), data that indirectly results from the use of the medical device or other health device (that is generated automatically by sensors or embedded applications, such as heart rate in a heart rate monitor), but also data generated when the user is inactive, such as when the device is on standby or even switched off (which provides data on battery life). Both personal and non-personal data are covered.

The data sharing provisions relate only to data that has not been substantially modified, more specifically raw data and data that has been pre-processed to make it understandable and usable (e.g. temperature, heart rate, glucose level, etc.). It also includes metadata, such as basic context and timestamps. In contrast, what is excluded is any derived information that is the outcome of additional investments into assigning values or insights from the data (e.g. diagnoses, tests, medical treatments, correlations between certain lifestyle factors and diseases, etc.). For example, a glucose measurement app that alerts when a glucose level is abnormally high and advises on what actions the user should then take would require sharing the glucose level, but not the conclusions regarding the high level or the actions to be taken.

The Act regulates data access and sharing obligations.

The Data Act requires manufacturers to design and manufacture connected medical devices and related digital services as well as other connected health devices in such a way that data generated by their use are, by default, easily and securely free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible to the user.

The design requirements only apply to products and related services placed on the market after 12 September 2026.

Connected medical devices and related digital services as well as other connected health devices that have already been placed on the market before that date will not require modifications to make the data directly accessible. The obligation to provide users with direct access raises some questions, for instance in the area of cybersecurity and in terms of increased processing power that may lead to a shortened battery life prompting faster replacement of essential products, such as pacemakers.

The last part of our presentation will focus on EU legislation on clinical trials and key practical assumption of Regulation (EU) No 536 of the European Parliament and of the Council of 16th April 2014 on clinical trials on medicinal products for human use

Regulation (EU) No 536 on clinical trials establishes a new set of harmonised rules that all member states are required to apply in all clinical trials performed throughout the European Union (EU). Although the Regulation entered into force on 16 June 2014 the timing of its application depended on the development of a fully functional EU clinical trials portal and database. It actually came into application on January 31, 2022. Before this Regulation the inherent differences in implementation at the national levels meant that multinational clinical trials were highly complex and fragmented within the EU.

There has been launched the Clinical Trials Information System (CTIS). This portal is the backbone for harmonising the submission, assessment, and supervision processes for clinical trials. The CTIS targets three main categories of users:

– Sponsors: Clinical trial sponsors (researchers from industry and academia) will use the CTIS to apply for authorisation to run a clinical trial in up to 30 EU/EEA countries via a single application. Sponsors can use the CTIS to provide updates to national regulators about a trial and to submit trial results.

– Authorities: EU/EEA national regulators will use the CTIS collaboratively to assess clinical trial applications, to authorise or refuse a trial, and to oversee an authorised trial.

– General Public: Anyone can use the CTIS to search for information on clinical trials. Clinical trial data will become publicly available through the CTIS once a decision on a clinical trial has been made.

On April 14, 2023, the long-awaited Polish Act on clinical trials of medicinal products for human use entered into force in Poland.

The Act will have a significant impact on the practice of conducting clinical trials in Poland, including legal requirements on the part of the sponsor, institution and researcher. The most important issues regulated at the local level include changes in the ethical assessment procedure of the study, increased financial burden on the sponsor related to obtaining permission to conduct the study, or the introduction of a new system of compensation benefits for clinical trial participants.

Key assumptions:

1. The Act introduces new and more detailed regulations in the field of non-commercial clinical trials (i.e. primarily those not conducted for purposes related to obtaining a marketing authorization for a drug or for marketing purposes). The most significant change is certainly the provision relating to non-commercial clinical trials financed entirely from public funds – the Act provides that data from such trials may be commercialized, e.g. used to obtain a marketing authorization for a drug, contrary to the general rule.

2. The new regulation also introduces provisions relating to the protection of personal data, providing for the possibility of limiting certain rights of persons whose data are processed. Pursuant to the Act, it is permissible to limit the application of the provisions of the GDPR regarding the right of access, rectification, restriction of processing and objection, if their implementation would prevent or seriously hamper the achievement of the objectives of a clinical trial and if such a restriction is necessary to achieve the objectives of the trial. The existing regulations requiring consent to data processing from research participants were rightly questioned.

3. The Act provides for a new structure for the functioning of bioethics committees assessing clinical trials. Pursuant to it, the Supreme Bioethics Committee, operating at the Medical Research Agency, is established. The idea of the regulation seems to be to centralize the activities of the previously dispersed bioethics committees and to organize the regulations in this area. The Supreme Bioethics Committee is to supervise the ethical assessment of clinical trials and organize the work of bioethics committees.

4. The Act describes the obligations of the sponsor and the researcher. These regulations are, to a large extent, clarifying in nature in relation to the provisions of the Regulation. Noteworthy is the clear regulation that the sponsor is obliged to obtain – in writing – the consent of the principal investigator and researchers for access to source documents.

5. Prior to the enactment of the CT Regulation, sponsors had to submit clinical trial applications separately to national competent authorities and ethics committees in each country. Sponsors waiting for regulatory approval to run a clinical trial inevitably experienced administrative delays.

Under the CT Regulation, it remains that a clinical trial shall undergo scientific and ethical review and requires prior authorisation. With the CTIS, the authorisation process is greatly simplified. Duplication of efforts is removed as the sponsors can now submit a single application for authorisation to run a multinational clinical trial, resulting in a single decision for all Member States concerned. The decision on the clinical trial is communicated to the sponsor via the CTIS.